Session Replay GDPR: Privacy Compliance Checklist

Session replay GDPR compliance starts with what you collect and why. Recordings that identify a person can contain personal data, including visible text, account details, console messages, and network payloads. Privacy regulations for session recording apply to the complete data flow, not only the replay video.

Use this checklist to review a support diagnostic workflow before rollout. Technical controls support your assessment; they do not establish compliance by themselves. Guidance reviewed September 7, 2026. This is implementation guidance, not legal advice for your particular deployment.

Session replay GDPR checklist

Masked inputs: Test passwords, payment fields, personal text, and dynamic content with synthetic data. Inspect console and network capture too: DOM masking does not cover every channel.
Dormant loading: Check a fresh visit, a stored-token visit, and widget activation. Confirm when the recorder loads and what storage or requests occur before any required consent.
Retention: Document a purpose-based deadline, verify automatic expiry, and include recordings and exports in the deletion workflow.
Access controls: Limit access to people who need the recording. Test another account and organisation, review sharing permissions, and remove access when duties change.
Notice and lawful basis: Explain what will be recorded before activation. Document the lawful basis and separately assess applicable device storage/access consent rules.
Vendor review: Review processor terms, subprocessors, hosting and transfers, rights-request support, and whether the processing needs a DPIA.

Try a privacy-focused diagnostic session. Start with synthetic data, mark sensitive content, and inspect what Clairvio captures before inviting a customer.

Start free — 25 sessions/month Watch the diagnostic demo Read our privacy policy

How privacy regulations apply to session recording

Under GDPR, identify the purpose and lawful basis, minimise personal data, set justified retention, and protect access. Consider notices, processor arrangements, international transfers, individual rights, and a DPIA where processing is likely to create high risk. See GDPR Articles 5, 6, 13, 17, 28, 32, 35 and Chapter V.

Legitimate interests requires a purpose, necessity, and balancing assessment; a support request does not automatically settle that assessment. Contractual necessity is not established simply by mentioning recording in your terms. If relying on consent, provide a real informed choice and a withdrawal mechanism.

Assess device storage and access separately. The ICO’s UK storage and access guidance explains that these rules extend beyond cookies and that consent or an applicable exception is needed. For EU deployments, assess the relevant national ePrivacy rules. A GDPR lawful basis does not remove a separate consent requirement.

Masked inputs: verify every capture channel

Clairvio masks password inputs and blocks elements marked data-clairvio-mask in the DOM replay. Other sensitive inputs and visible text need application-specific review; password masking is not blanket masking of all inputs.

Clairvio redacts built-in sensitive network headers and supports configured JSON field redaction. Test URLs, response bodies, non-JSON payloads, and console messages separately. A field hidden in the replay may still appear in a log or request. Use synthetic examples of your own sensitive fields to inspect the recorded result.

This is an engineering application of data protection by design and default: choose capture settings around the investigation, and avoid collecting unrelated information. See our privacy-first recording guide for related workflow considerations.

Dormant loading: smaller capture scope, not a consent exemption

Clairvio’s loader checks URL tokens and local storage before injecting the recorder. Without a token, it returns without loading the full SDK. A stored token can cause loading on a later page, so test returning visits as well as a clean browser.

The loader script itself must still be fetched, and a separately enabled widget can make its own requests. Describe the actual network and storage behavior in your assessment rather than claiming that an inactive recorder means no processing.

On-demand capture can limit recordings to a support reproduction. It cannot reconstruct an earlier unrecorded incident. Compare on-demand and always-on recording against the coverage your team needs.

Retention and access controls: test the lifecycle

Clairvio’s plan retention windows are 7 days on Free, 30 on Starter, 90 on Growth, and 365 on Scale. The service includes a scheduled expiry cleanup. These are product limits, not GDPR-approved retention periods; select a workflow that meets your documented needs. See session replay pricing and retention.

Verify deletion in your deployment, including recordings, related data, and copies exported to tickets or other systems. Handle rights requests according to applicable requirements and exceptions, rather than assuming every request has the same outcome.

For access, test with an authorised investigator, an unauthorised account, and a user from another organisation. Review invitations and sharing routes. Keep a record of who needs access and revoke it when no longer needed. These are deployment checks, not a claim that every possible role or audit feature is supplied by default.

Session replay and GDPR: common questions

Is session replay GDPR compliant?

A recording tool cannot guarantee compliance for your deployment. Assess the purpose, lawful basis, disclosures, collection settings, retention, access, and applicable individual rights before recording personal data.

Does clicking a diagnostic link count as consent?

Not by itself. Where consent is required, the choice must be informed, specific, freely given, and unambiguous, with a way to withdraw. Explain recording before activation and assess device storage and access rules separately.

Does dormant loading mean no data processing?

No. Clairvio’s loader checks the URL and local storage for a session token. It loads the recorder when a token is present. Loading the script and any separately enabled widget may also involve requests; inspect your complete deployment.

How long should session recordings be retained?

Choose the shortest period justified by the investigation, rather than treating a plan allowance as a legal retention recommendation. Test expiry and deletion, including exported copies.

Validate a diagnostic session before rollout

Create a test account with synthetic data, mark sensitive elements, activate a diagnostic link, and review the replay alongside console and network events. Repeat the checks after changes to forms or capture configuration.

Start a free Clairvio workspace to run that evaluation, or watch the diagnostic demo first.